The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources such as email campaigns, workflows, and subscriber records, creating an attack surface for indirect prompt injection.
Ingestion points: Data is retrieved via tools like get_subscriber, get_campaign, and get_workflow in SKILL.md.
Boundary markers: The instructions lack explicit delimiters or warnings for the agent to ignore instructions that might be embedded in the retrieved data.
Capability inventory: The agent has write permissions including create_campaign, edit_campaign, and configure_workflow_draft, which could be abused if malicious instructions are processed.
Sanitization: No content sanitization or validation logic is specified for the data fetched from the Lumail platform.
[COMMAND_EXECUTION]: The skill includes instructions for status and login commands (claude mcp, codex mcp) and references the npx lumail CLI tool for advanced functionality if the scoped OAuth connection is insufficient.

lumail-plugin